Index Retention by Time Only

[aferone]

We would like to retain data in our indexes by time only. Is this possible? I think I am doing it correctly for our internal index by using the following line, for 90 days:

frozenTimePeriodInSecs = 7776000

Is this correct, and can I use this line to retain indexes solely on time for all indexes, instead on disk size?

Thanks!

[_d_ · Accepted solution]

Yes, this is correct. However, as a precaution I would also suggest setting maxTotalDataSizeMB to a reasonably large value so that frozenTimePeriodInSecs hits before it does.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

[_d_]

Yes. Splunk will freeze data when either of maxtotaldatasizeMB or frozenTimePeriodInSecs is reached first. So, if you reach a size of 500GB (which is the defult maxtotaldatasizeMB), say, on day 61, old data will be frozen even though it's not 90 days old.

[aferone]

Thanks for answering! Can you explain the need for setting the maxtotaldatasizeMB though? Is it just as a fail safe?